A Chinese-speaking hacker outsourced almost an entire hacking spree to AI agents, which autonomously probed and broke into websites belonging to more than 100 companies — including Deere, SharkNinja and Cummins — for roughly $50 in AI tokens per successful intrusion. Reuters reported the campaign on Monday, October 19, based on a report by NorForge principal threat researcher Snorre Fagerland that was provided to Reuters ahead of publication.
Reuters independently reviewed the hacker’s activity to identify victims that Fagerland’s report did not name. The hacker did almost none of the work personally, Reuters said.
How The Campaign Was Watched: Exposed Cairn Instances
Fagerland found the activity while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. Beginning around October 2, he found about two dozen instances of Cairn being used for malicious activity, which let him quietly watch over the cybercriminals’ shoulders as they set their AI tools loose.
The Chinese-speaking hacker was the most prolific of those he observed. Beginning on September 25, they set their agents against e-commerce websites in the United States, Canada, Australia and Japan. Their instructions were terse — fewer than 100 Chinese characters sketching out their preferred intrusion tactics.
By late last week, the agents had attempted to break into more than 1,200 sites. Successful intrusions typically took around 23 hours of probing for vulnerabilities. Fagerland estimated the campaign, which appeared to use a mixture of China’s DeepSeek and Anthropic’s Claude Code, had consumed roughly $5,000 worth of tokens — about $50 per successful hack.
Reuters could not ascertain how much data, if any, was extracted. Deere told Reuters it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” Two smaller businesses also acknowledged being compromised; other victims in the Cairn data did not return messages.
What The Agents Did Without Supervision
Fagerland, who has worked in cybersecurity for nearly three decades, said some techniques impressed him. In one case, after failing to find weaknesses in a big company’s public-facing application, the agents pored through digital records to find associated infrastructure, located a public-facing control panel, discovered a subtle weakness in how it processed data, and after hours of trial and error tricked the server into executing malicious commands. “It’s not straightforward to come up with solutions like that,” he said. “It’s not script kiddie stuff.”
“It’s a new world now,” Fagerland said, calling the campaign real-life evidence that commercially available AI agents can pull off complex intrusions from start to finish without human intervention. He said he had previously assumed hacker-agents would need at least some supervision; the technology has moved past that.
The hacker was not alone in the exposed instances. One of the others Fagerland observed stole a trove of credit card data; another tried to get AI agents to rob a cryptocurrency exchange. Cairn’s author, whose social media handle is “le1xia0”, acknowledged a Reuters message but did not immediately answer questions, and posted on X that the platform “was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention.”
The pattern matches the threat our coverage has tracked from the defender’s side: the NIST, NSA and CISA incident playbook for autonomous agents, the OpenCode console breach, and sites blocking AI agents from accounts and bookings. Google’s Harness2 framework shows the same autonomy being built deliberately, for defenders.
Why It Matters
The central entity is the autonomous AI agent as an intrusion tool, and its attributes have changed: cost per successful break-in measured in tens of dollars, endurance measured in days of unsupervised probing, and skill that a veteran researcher rates above script-kiddie level. Its neighbours feel it directly — every e-commerce operator whose site can now be attacked at machine scale, the model providers whose tools powered both sides of the campaign, and defenders whose playbooks assumed a human attacker’s time and budget as natural limits. When one person with a few thousand dollars can run the equivalent of a small hacking team, detection and patching speeds set for human attackers stop being enough.
Background
Agentic AI moved from chatbots to software that acts — browsing, coding and running tools — over the past two years, and the security world has been bracing for its misuse. Gambit Security documented Russian-speaking extortionists using an AI coding tool to break into seven organisations in August, and an agent-driven spree in September that breached 25 companies and stole at least 600,000 credit card records; Bitsight said last week that forum discussion of autonomous agents among cybercriminals is surging. Fagerland’s Cairn observations are the clearest public look yet at that shift happening in the wild.
Source: Reuters
0 Comments